Below is the app log content and the configuration parameters in props.conf. Not sure what is going wrong.. Output is all messed up and I dont see the events getting generated seperatly.. Any help??
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY
;ZZZZ
;ZZZY
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1
;ZZRZ
;ZZRY
TRUNCATE=240000
TIME_PREFIX = ^Timestamp:\s
TIME_FORMAT= %m/%d/%Y %H:%M:%S
LINE_BREAKER = ([\r\n]+)(?=Timestamp:\s)
SHOULD_LINEMERGE=false
This is what I am expecting on SPLUNK
Event One
11/12/2012 07:59 V XXXXXX YYY ;YYYY;1234
Event two
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY
;ZZZZ
;ZZZY
Event three..
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUUU
11/12/2012 07:59 V XXXXXX YYY ;YYYY;YYYY; UUUU1
;ZZRZ
;ZZRY
... View more